create-website-build-kit 0.1.0

package/template/scripts/extract.mjs

@@ -0,0 +1,317 @@
+/**
+ * Turn the captured HTML in recon/html/ into clean markdown, one file per page.
+ *
+ *   npm run extract                       # every page recon captured
+ *   npm run extract -- --only=about       # one, substring match on the slug
+ *   npm run extract -- --dir=recon/html   # a different capture directory
+ *
+ * Writes recon/extracted/<slug>.md — frontmatter plus body — and prints a table
+ * of what came out, with the pages worth re-reading flagged.
+ *
+ * ── WHY THIS EXISTS ────────────────────────────────────────────────────────
+ * `recon` captured the rendered HTML and NOTHING CONSUMED IT. `build.md` phase
+ * 1 said "pull copy, media and metadata into structured files" and named no
+ * tool, so every migration hand-rolled an extractor at the point in the project
+ * where there is least time to write one carefully.
+ *
+ * On one build that left 18 pages of captured HTML sitting in recon/html/ while
+ * the site shipped with a home page and nothing else.
+ *
+ * ── IT DOES NOT DECIDE THE CONTENT MODEL ───────────────────────────────────
+ * Output goes to recon/extracted/, not src/content/. What the collections are,
+ * which pages collapse into template + data, and which of these should exist at
+ * all are phase-2 decisions and project-shaped — `build.md` §2. This produces
+ * reviewable markdown; a person places it.
+ *
+ * ── WHY A DEPENDENCY ───────────────────────────────────────────────────────
+ * `traps.md` has the entry: `html.replace(/<[^>]+>/g, '')` glues the text
+ * either side of every tag it removes, so a heading runs into its paragraph and
+ * a sentence into its link — but only where the source markup had no newline
+ * between the tags, which is every page builder's minified output. So the
+ * hand-rolled version is right on the pretty-printed pages and wrong on the
+ * rest, and it reads as a content problem rather than a converter one.
+ *
+ * Getting whitespace, nesting and list indentation right is the entire job, and
+ * turndown already does. It is 30 KB with no dependencies of its own. This is
+ * the dependency `build.md` §2 means by "reach for the heavy option when the
+ * task needs it".
+ */
+
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+
+import TurndownService from 'turndown';
+
+const RESET = '\x1b[0m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+const DIM = '\x1b[2m';
+const BOLD = '\x1b[1m';
+
+const args = process.argv.slice(2);
+const only = (args.find((a) => a.startsWith('--only=')) ?? '').replace('--only=', '');
+const SRC = (args.find((a) => a.startsWith('--dir=')) ?? '').replace('--dir=', '') || 'recon/html';
+const OUT = 'recon/extracted';
+
+if (!existsSync(SRC)) {
+  console.error(
+    `${RED}✗${RESET} ${SRC} not found.\n` +
+      '  Run `npm run recon -- https://old-site.com` first — that is what captures the HTML.',
+  );
+  process.exit(1);
+}
+
+/*
+ * Remove an element and everything inside it, innermost first.
+ *
+ * A single non-greedy regex stops at the FIRST closing tag, so a <nav> holding
+ * a nested <nav> leaves the outer half behind — visible as a stray fragment of
+ * menu at the top of the extracted copy. Matching only spans that contain no
+ * further opening tag of the same name, repeatedly, unwinds nesting correctly.
+ */
+function stripElement(html, tag) {
+  const inner = new RegExp(`<${tag}\\b[^>]*>(?:(?!<${tag}\\b)[\\s\\S])*?<\\/${tag}>`, 'gi');
+  let out = html;
+  for (let pass = 0; pass < 20; pass++) {
+    const next = out.replace(inner, '');
+    if (next === out) break;
+    out = next;
+  }
+  /* Self-closing and unclosed leftovers. */
+  return out.replace(new RegExp(`<\\/?${tag}\\b[^>]*>`, 'gi'), '');
+}
+
+/** Chrome, not content. Removed before the region is chosen and after. */
+const FURNITURE = ['script', 'style', 'noscript', 'svg', 'nav', 'header', 'footer', 'aside', 'form', 'iframe'];
+
+const attr = (html, re) => re.exec(html)?.[1]?.trim() ?? '';
+const text = (html) => html.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim();
+
+const decode = (s) =>
+  s
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#0?39;|&apos;|&rsquo;/g, "'")
+    .replace(/&ldquo;|&rdquo;/g, '"')
+    .replace(/&mdash;/g, '—')
+    .replace(/&ndash;/g, '–');
+
+/*
+ * The content region. <main> is the answer when a theme emits one; <article> is
+ * the fallback; <body> is the last resort and is reported, because a page
+ * extracted from <body> has usually kept some chrome and wants a human.
+ */
+function contentRegion(html) {
+  for (const [tag, label] of [['main', '<main>'], ['article', '<article>']]) {
+    const m = new RegExp(`<${tag}\\b[^>]*>([\\s\\S]*)<\\/${tag}>`, 'i').exec(html);
+    if (m && text(m[1]).length > 200) return { region: m[1], from: label };
+  }
+  const body = /<body\b[^>]*>([\s\S]*)<\/body>/i.exec(html);
+  return { region: body?.[1] ?? html, from: '<body> — check for leftover chrome' };
+}
+
+/*
+ * Portable image references, per build.md §2: content stores a path, never an
+ * infrastructure URL. WordPress's generated `-300x200` sizes and Elementor's
+ * thumbnail crops both point at derivatives — you want the original, and
+ * `npm run media` will regenerate the sizes.
+ */
+function portableSrc(src) {
+  let out = src.trim();
+  try {
+    out = new URL(out, 'https://placeholder.invalid').pathname;
+  } catch {
+    /* leave a relative path alone */
+  }
+  return out
+    .replace(/\/uploads\/elementor\/thumbs\//, '/uploads/')
+    .replace(/-\d{2,4}x\d{2,4}(?=\.[a-z]{3,4}$)/i, '')
+    .replace(/-scaled(?=\.[a-z]{3,4}$)/i, '');
+}
+
+const turndown = new TurndownService({
+  headingStyle: 'atx',
+  bulletListMarker: '-',
+  codeBlockStyle: 'fenced',
+  emDelimiter: '*',
+});
+
+/* A builder wraps everything in divs and spans; they carry no meaning here. */
+turndown.addRule('unwrap', {
+  filter: ['div', 'span', 'section', 'figure'],
+  replacement: (content) => content,
+});
+
+const files = readdirSync(SRC)
+  .filter((f) => f.endsWith('.html'))
+  .filter((f) => !only || f.includes(only))
+  .sort();
+
+if (!files.length) {
+  console.error(`${RED}✗${RESET} no .html in ${SRC}${only ? ` matching --only=${only}` : ''}`);
+  process.exit(1);
+}
+
+mkdirSync(OUT, { recursive: true });
+
+console.log(`${BOLD}── Extract ${'─'.repeat(48)}${RESET}`);
+console.log(`  ${DIM}${files.length} page(s) from ${SRC}/ → ${OUT}/${RESET}\n`);
+
+const rows = [];
+
+for (const file of files) {
+  const slug = file.replace(/\.html$/, '');
+  const raw = readFileSync(`${SRC}/${file}`, 'utf8');
+  const flags = [];
+
+  const seoTitle = decode(text(attr(raw, /<title[^>]*>([\s\S]*?)<\/title>/i)));
+  const description = decode(
+    attr(raw, /<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i),
+  );
+  const canonical = attr(raw, /<link[^>]+rel=["']canonical["'][^>]+href=["']([^"']+)["']/i);
+  const ogImage = attr(raw, /<meta[^>]+property=["']og:image["'][^>]+content=["']([^"']+)["']/i);
+
+  let { region, from } = contentRegion(raw);
+  if (from.startsWith('<body>')) flags.push('region');
+
+  for (const tag of FURNITURE) region = stripElement(region, tag);
+  region = region.replace(/<!--[\s\S]*?-->/g, '');
+
+  const h1 = decode(text(attr(region, /<h1[^>]*>([\s\S]*?)<\/h1>/i))) ||
+    decode(text(attr(raw, /<h1[^>]*>([\s\S]*?)<\/h1>/i)));
+  if (!h1) flags.push('no-h1');
+
+  /*
+   * Lazy-load placeholders: the real file is in data-src and `src` holds a
+   * transparent gif or a base64 blur. Taking `src` migrates the placeholder,
+   * which looks like a broken image on a page that built perfectly.
+   */
+  const images = [];
+  region = region.replace(/<img\b[^>]*>/gi, (tag) => {
+    const lazy = attr(tag, /\sdata-(?:src|lazy-src|original)=["']([^"']+)["']/i);
+    const plain = attr(tag, /\ssrc=["']([^"']+)["']/i);
+    const chosen = lazy || plain;
+    if (!chosen || /^data:/i.test(chosen)) return '';
+    const src = portableSrc(chosen);
+    const alt = decode(attr(tag, /\salt=["']([^"']*)["']/i));
+    /*
+     * Empty alt is the obvious failure. The commoner one is alt text the CMS
+     * generated FROM THE FILENAME — "pic 11", "service-maintenance-worker-
+     * repairing" — which passes every automated check, reads as described, and
+     * tells a screen-reader user nothing. Seen on every page of a real capture.
+     */
+    if (!alt) flags.push('img-alt');
+    else if (alt.replace(/[\s-]+/g, '-').toLowerCase() === src.split('/').pop().replace(/\.[a-z]+$/i, '').replace(/[\s-]+/g, '-').toLowerCase().slice(0, alt.length + 8).replace(/-+$/, '')) {
+      flags.push('alt-filename');
+    }
+    images.push({ src, alt });
+    return `<img src="${src}" alt="${alt}">`;
+  });
+
+  /* srcset points at generated sizes that will not exist on the new site. */
+  region = region.replace(/\ssrcset=["'][^"']*["']/gi, '').replace(/\ssizes=["'][^"']*["']/gi, '');
+
+  let body = turndown.turndown(region);
+  body = decode(body)
+    .replace(/\n{3,}/g, '\n\n')
+    .replace(/[ \t]+$/gm, '')
+    .trim();
+
+  const words = body.split(/\s+/).filter(Boolean).length;
+  if (words < 80) flags.push('thin');
+
+  /*
+   * ⚠ PAGE BUILDERS USE HEADING TAGS AS TYPE STYLES. On a real capture the
+   * lede paragraph was an <h5> and every section title an <h6>, chosen because
+   * they looked right in the builder's preview — so the extracted markdown
+   * carries a hierarchy that jumps h1 → h5 and never uses h2 at all.
+   *
+   * It survives every automated check (`verify` counts h1s, and there is
+   * exactly one), reads correctly to a sighted visitor, and is both an
+   * accessibility failure and the outline Google reads. build.md phase 1 says
+   * "normalise heading levels" — this is what it is asking you to look at.
+   */
+  const levels = [...body.matchAll(/^(#{1,6})\s/gm)].map((m) => m[1].length);
+  const jumps = levels.some((l, i) => i > 0 && l - levels[i - 1] > 1);
+  const deepOnly = levels.length > 2 && !levels.includes(2) && levels.some((l) => l >= 4);
+  if (jumps || deepOnly) flags.push('headings');
+
+  /*
+   * The script checks its own output for the failure it exists to prevent.
+   * traps.md has the entry; turndown does not create these, but a source page
+   * that genuinely lacked the space will carry it through, and either way it is
+   * a line somebody has to read.
+   */
+  const prose = body
+    /* A link TARGET is not prose. `goo.gl/uQxkSHWN…` matched the pattern on
+       every page of a real capture — the detector was reading URL slugs. */
+    .replace(/\]\([^)]*\)/g, ']')
+    .replace(/https?:\/\/\S+/g, '')
+    /* Nor is a code span, which is where identifiers legitimately live. */
+    .replace(/`[^`]*`/g, '');
+
+  const glued = [...prose.matchAll(/[a-z](?:https?:\/\/|[A-Z][a-z]{2,})/g)]
+    .map((m) => m[0])
+    .filter((s) => !/iPhone|YouTube|JavaScript|WordPress|PayPal|eBay|iPad|macOS/i.test(s));
+  if (glued.length) flags.push(`glued:${glued.length}`);
+
+  const yaml = [
+    '---',
+    `source: ${canonical || `/${slug === 'index' ? '' : slug + '/'}`}`,
+    `title: ${JSON.stringify(h1 || seoTitle || slug)}`,
+    seoTitle && seoTitle !== h1 ? `seoTitle: ${JSON.stringify(seoTitle)}` : null,
+    `description: ${JSON.stringify(description)}`,
+    ogImage ? `ogImage: ${JSON.stringify(portableSrc(ogImage))}` : null,
+    images.length ? 'images:' : null,
+    ...images.map((i) => `  - src: ${JSON.stringify(i.src)}\n    alt: ${JSON.stringify(i.alt)}`),
+    '---',
+    '',
+  ].filter((l) => l !== null);
+
+  writeFileSync(`${OUT}/${slug}.md`, `${yaml.join('\n')}\n${body}\n`);
+  rows.push({ slug, words, images: images.length, from, flags });
+}
+
+/* ── Report ─────────────────────────────────────────────────────────────── */
+
+const pad = Math.max(...rows.map((r) => r.slug.length));
+for (const r of rows) {
+  const mark = r.flags.length ? `${YELLOW}!${RESET}` : `${GREEN}✓${RESET}`;
+  /* One flag per kind, with a count. Four images with filename alt text is one
+     thing to fix, not four things to read. */
+  const counted = [...r.flags.reduce((m, f) => m.set(f, (m.get(f) ?? 0) + 1), new Map())]
+    .map(([f, n]) => (n > 1 ? `${f}×${n}` : f))
+    .join(' ');
+  console.log(
+    `  ${mark} ${r.slug.padEnd(pad)}  ${String(r.words).padStart(5)} words  ` +
+      `${String(r.images).padStart(3)} img  ${DIM}${counted}${RESET}`,
+  );
+}
+
+const legend = {
+  region: 'no <main> or <article> — extracted from <body>, check for leftover chrome',
+  'no-h1': 'no <h1> found — the title fell back to <title> or the slug',
+  thin: 'under 80 words — the page may be mostly a builder layout, or the capture is partial',
+  'img-alt': 'at least one image had no alt text — write it, do not copy the filename',
+  'alt-filename': 'alt text derived from the filename ("pic 11") — reads as described, says nothing',
+  headings: 'heading levels jump or start deep — the builder used them as type styles, not structure',
+  glued: 'run-together words, e.g. "AreasWe". traps.md has the entry — read these',
+};
+const seen = new Set(rows.flatMap((r) => r.flags.map((f) => f.split(':')[0])));
+if (seen.size) {
+  console.log(`\n  ${DIM}${'─'.repeat(56)}${RESET}`);
+  for (const key of seen) if (legend[key]) console.log(`  ${DIM}${key.padEnd(8)} ${legend[key]}${RESET}`);
+}
+
+console.log(
+  `\n${GREEN}✓${RESET} ${rows.length} page(s) → ${OUT}/  ` +
+    `${DIM}${rows.reduce((n, r) => n + r.words, 0).toLocaleString()} words, ` +
+    `${rows.reduce((n, r) => n + r.images, 0)} image(s)${RESET}`,
+);
+console.log(
+  `  ${DIM}Not placed in src/content/ deliberately — what the collections are is a phase-2\n` +
+    `  decision. Read these, then move what survives. build.md §2.${RESET}\n`,
+);

package/template/scripts/indexnow.mjs

@@ -0,0 +1,154 @@
+/**
+ * Submit URLs to IndexNow — Bing, Yandex, Seznam, Naver.
+ *
+ *   node scripts/indexnow.mjs                      # every URL in the live sitemap
+ *   node scripts/indexnow.mjs /about/ /contact/    # just these routes
+ *
+ * Run it AFTER a deploy has finished, never before. See the key check below.
+ *
+ * ── GOOGLE DOES NOT PARTICIPATE ────────────────────────────────────────────
+ * It is printed on every run, deliberately. IndexNow is Bing, Yandex, Seznam
+ * and Naver; Google has repeatedly declined to join. A green result here is not
+ * "submitted to search engines", and reading it that way is how a site goes
+ * weeks without anyone checking why Google has not picked something up.
+ *
+ * For Google, use Search Console — the URL Inspection tool for one page, or a
+ * sitemap resubmission for a batch.
+ *
+ * ── SETUP ──────────────────────────────────────────────────────────────────
+ * 1. Invent a key: 8–128 hex characters. `openssl rand -hex 16` is fine.
+ * 2. Put it in a file whose NAME is the key: public/<key>.txt, containing the
+ *    key and nothing else.
+ * 3. Deploy, so the file is live.
+ * 4. export INDEXNOW_KEY=<key>
+ */
+
+import { readFileSync, existsSync } from 'node:fs';
+
+const RESET = '';
+const RED = '';
+const GREEN = '';
+const YELLOW = '';
+const DIM = '';
+
+const key = process.env.INDEXNOW_KEY;
+if (!key) {
+  console.error(
+    `${RED}✗${RESET} INDEXNOW_KEY is not set.\n` +
+      '  Invent one with `openssl rand -hex 16`, save it as public/<key>.txt\n' +
+      '  containing the key, deploy, then export INDEXNOW_KEY=<key>.',
+  );
+  process.exit(1);
+}
+if (!/^[a-fA-F0-9]{8,128}$/.test(key)) {
+  console.error(`${RED}✗${RESET} INDEXNOW_KEY must be 8–128 hex characters.`);
+  process.exit(1);
+}
+
+/* The production host. Read from the same place the build reads it, so this
+   cannot be pointed at staging by accident — submitting a noindex staging host
+   is a waste at best. */
+const SITE = (process.env.PUBLIC_SITE_URL ?? '').replace(/\/$/, '');
+if (!SITE || !SITE.startsWith('https://')) {
+  console.error(
+    `${RED}✗${RESET} PUBLIC_SITE_URL must be the https production origin.\n` +
+      '  e.g. PUBLIC_SITE_URL=https://example.com node scripts/indexnow.mjs',
+  );
+  process.exit(1);
+}
+const host = new URL(SITE).hostname;
+
+if (!existsSync(`public/${key}.txt`)) {
+  console.warn(
+    `${YELLOW}!${RESET} public/${key}.txt is not in this repo. It must be, or the\n` +
+      '  next deploy removes the key file and every later submission is rejected.',
+  );
+}
+
+/**
+ * ── VERIFY THE KEY FILE IS REACHABLE BEFORE POSTING ────────────────────────
+ *
+ * IndexNow validates ownership by fetching https://<host>/<key>.txt at the
+ * moment of submission. Submit before the deploy carrying that file has
+ * finished and the whole batch is rejected with a 403 — and because the API
+ * answers 200 for an accepted batch and says nothing else useful, a script that
+ * skipped this check would print success for a submission that never happened.
+ *
+ * A script that reports someone else's success is worse than no script.
+ */
+const keyUrl = `${SITE}/${key}.txt`;
+const probe = await fetch(keyUrl).catch(() => null);
+if (!probe?.ok) {
+  console.error(
+    `${RED}✗${RESET} ${keyUrl} is not reachable (${probe ? probe.status : 'no response'}).\n` +
+      '  IndexNow fetches this to verify ownership. Deploy first, then submit.',
+  );
+  process.exit(1);
+}
+const served = (await probe.text()).trim();
+if (served !== key) {
+  console.error(
+    `${RED}✗${RESET} ${keyUrl} does not contain the key.\n` +
+      `  Served: ${JSON.stringify(served.slice(0, 40))}\n  Expected: ${key}`,
+  );
+  process.exit(1);
+}
+
+/* URLs: either the routes given as arguments, or the live sitemap. */
+const args = process.argv.slice(2);
+let urls;
+
+if (args.length) {
+  urls = args.map((r) => new URL(r, SITE + '/').href);
+} else {
+  const res = await fetch(`${SITE}/sitemap-index.xml`).catch(() => null);
+  const indexXml = res?.ok ? await res.text() : '';
+  const maps = [...indexXml.matchAll(/<loc>([^<]+)<\/loc>/g)].map((m) => m[1]);
+  const sources = maps.length ? maps : [`${SITE}/sitemap-0.xml`];
+
+  urls = [];
+  for (const map of sources) {
+    const r = await fetch(map).catch(() => null);
+    if (!r?.ok) continue;
+    const xml = await r.text();
+    urls.push(...[...xml.matchAll(/<loc>([^<]+)<\/loc>/g)].map((m) => m[1]));
+  }
+  urls = [...new Set(urls)];
+}
+
+if (!urls.length) {
+  console.error(
+    `${RED}✗${RESET} No URLs to submit. The sitemap is empty or unreachable —\n` +
+      '  note that staging builds emit no sitemap, deliberately.',
+  );
+  process.exit(1);
+}
+
+/* The API caps a batch at 10,000. Well above any site this kit builds, but a
+   silent truncation would read as a full submission. */
+if (urls.length > 10000) {
+  console.error(`${RED}✗${RESET} ${urls.length} URLs exceeds the 10,000 batch limit.`);
+  process.exit(1);
+}
+
+const response = await fetch('https://api.indexnow.org/indexnow', {
+  method: 'POST',
+  headers: { 'content-type': 'application/json; charset=utf-8' },
+  body: JSON.stringify({ host, key, keyLocation: keyUrl, urlList: urls }),
+});
+
+/* 200 accepted, 202 accepted but key still validating. Anything else is a
+   refusal and the URLs were NOT submitted. */
+if (response.status !== 200 && response.status !== 202) {
+  console.error(
+    `${RED}✗${RESET} IndexNow refused the batch: ${response.status} ${response.statusText}\n` +
+      `  ${(await response.text().catch(() => '')).slice(0, 300)}`,
+  );
+  process.exit(1);
+}
+
+console.log(`${GREEN}✓${RESET} ${urls.length} URL(s) submitted for ${host} (${response.status}).`);
+console.log(
+  `${DIM}  Bing, Yandex, Seznam and Naver. Google does NOT participate in IndexNow —\n` +
+    `  for Google use Search Console: URL Inspection, or resubmit the sitemap.${RESET}`,
+);

package/template/scripts/lastmod.mjs

@@ -0,0 +1,147 @@
+/**
+ * Regenerate src/data/lastmod.json — per-route content dates for the sitemap.
+ *
+ *   npm run lastmod        # then commit the JSON alongside your change
+ *
+ * ── WHY A COMMITTED FILE AND NOT git AT BUILD TIME ────────────────────────
+ * The first implementation read `git log` during the Astro build. It worked
+ * locally and emitted NOTHING in production, because Cloudflare Workers Builds
+ * shallow-clones: `git log` returns one grafted commit for every file, so the
+ * module's own guard correctly refused to stamp 23 identical dates.
+ *
+ * That guard was right and the design was wrong. A build should not depend on
+ * repository history it may not have been given. So the dates are computed
+ * here, by a human running a script with a full clone, and committed as data —
+ * which is how every other fact in this project is handled.
+ *
+ * ── UNCOMMITTED WORK COUNTS AS TODAY ──────────────────────────────────────
+ * If a page's source is modified but not yet committed, its last commit date
+ * is the PREVIOUS edit — so running this before committing would record a date
+ * that is already stale. Modified files are therefore dated today, so the
+ * normal flow works:
+ *
+ *     edit a page → npm run lastmod → commit both together
+ *
+ * ── WHAT MOVES A DATE, AND WHAT DELIBERATELY DOES NOT ─────────────────────
+ * A route's own page file and content file move it. Layout, nav and stylesheet
+ * changes do NOT — see the long note in src/lib/lastmod.mjs. Google asks for
+ * the last SIGNIFICANT content change and says not to bump for boilerplate;
+ * treating a footer edit as a change to all 23 pages collapses every date to
+ * the same day and destroys the only signal the field carries.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readdirSync, writeFileSync } from 'node:fs';
+
+const OUT = 'src/data/lastmod.json';
+
+const git = (args) =>
+  execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+
+if (git(['rev-parse', '--is-shallow-repository']) === 'true') {
+  console.error(
+    'This is a shallow clone — per-file history is not available, so the dates\n' +
+      'would all be identical. Run `git fetch --unshallow` first.',
+  );
+  process.exit(1);
+}
+
+/** Files with uncommitted changes. Their real "last modified" is now, not their last commit. */
+const dirty = new Set(
+  git(['status', '--porcelain'])
+    .split('\n')
+    .filter(Boolean)
+    .map((l) => l.slice(3).trim()),
+);
+
+const today = new Date().toISOString().slice(0, 10);
+
+function newest(files) {
+  const present = files.filter((f) => existsSync(f));
+  if (!present.length) return null;
+  if (present.some((f) => dirty.has(f))) return today;
+  try {
+    const out = git(['log', '-1', '--format=%cI', '--', ...present]);
+    return out ? out.slice(0, 10) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * ⚠ PROJECT CONFIG. Routes whose content comes from somewhere other than a
+ * same-named page file — a data file, a shared component, an API route.
+ *
+ * A route's date is the newest commit touching its own page file plus anything
+ * listed here. Omitting a real source UNDERSTATES a page's freshness, which is
+ * the safer direction to be wrong in: a crawler re-crawls later than ideal,
+ * rather than being told something false.
+ *
+ * ⚠ Deliberately NOT here: layouts, nav and stylesheets. Adding them is
+ * literally correct — a footer link does change every document — and it
+ * collapses every route to the same date, which is indistinguishable from
+ * stamping the build time and carries no prioritisation signal at all. Google
+ * asks for the last SIGNIFICANT content change and says explicitly not to bump
+ * for navigation or boilerplate.
+ *
+ *   '/pricing/': ['src/data/pricing.json'],
+ *   '/contact/': ['src/pages/api/contact.ts'],
+ */
+const EXTRA_SOURCES = {};
+
+const sources = new Map();
+
+const walk = (dir, prefix = '') => {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = `${dir}/${entry.name}`;
+    if (entry.isDirectory()) {
+      if (entry.name !== 'api') walk(full, `${prefix}${entry.name}/`);
+      continue;
+    }
+    if (!entry.name.endsWith('.astro') || entry.name.startsWith('[')) continue;
+    const base = entry.name.replace(/\.astro$/, '');
+    sources.set(base === 'index' ? `/${prefix}` : `/${prefix}${base}/`, [full]);
+  }
+};
+walk('src/pages');
+
+/*
+ * ⚠ PROJECT CONFIG — content collections rendered through a dynamic route.
+ *
+ * The markdown is what actually changed, so it leads; the template is a
+ * secondary source. Each directory is optional: a project without the
+ * collection simply skips it rather than crashing, because a kit script that
+ * assumes a directory exists only works on the project it was written for.
+ *
+ *   { dir: 'src/content/legal', template: 'src/pages/[slug].astro', prefix: '' }
+ */
+const COLLECTIONS = [
+  { dir: 'src/content/legal', template: 'src/pages/[slug].astro', prefix: '' },
+];
+
+for (const { dir, template, prefix } of COLLECTIONS) {
+  if (!existsSync(dir)) continue;
+  for (const file of readdirSync(dir)) {
+    if (!file.endsWith('.md')) continue;
+    sources.set(`/${prefix}${file.replace(/\.md$/, '')}/`, [`${dir}/${file}`, template]);
+  }
+}
+
+/* Routes the sitemap never contains. Dating them is harmless but misleading. */
+/* Routes the sitemap never contains — keep in step with the filter in
+   astro.config.mjs. Dating them is harmless but misleading. */
+const EXCLUDED = new Set(['/404/', '/search/', '/thank-you/']);
+
+const out = {};
+for (const [route, files] of [...sources].sort()) {
+  if (EXCLUDED.has(route)) continue;
+  const date = newest([...files, ...(EXTRA_SOURCES[route] ?? [])]);
+  if (date) out[route] = date;
+}
+
+writeFileSync(OUT, JSON.stringify(out, null, 2) + '\n');
+
+const spread = Object.values(out).reduce((m, d) => m.set(d, (m.get(d) ?? 0) + 1), new Map());
+console.log(`${Object.keys(out).length} routes written to ${OUT}`);
+for (const [date, n] of [...spread].sort()) console.log(`  ${date}  ${n} page${n > 1 ? 's' : ''}`);
+if (dirty.size) console.log(`\n${dirty.size} uncommitted file(s) dated today — commit the JSON with them.`);